---
title: [OR] [CCB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios
description: [OR] [CCB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios
image: https://blog.bcm-institute.org/hubfs/eBook%20Generic%20Morepost/OR/OR%20GEN%20E3%20Morepost/%5BOR%5D%20%5BGEN%5D%20%5BE3%5D%20%5BCBS%5D%20%5BSuPS%5D%20Identify%20Severe%20but%20Plausible%20Scenarios.jpg
---
. .
[](http://www.bcm-institute.org/)
- [Home](https://www.bcm-institute.org/)
- [About Us](https://www.bcm-institute.org/about-us-3/)
- [A President’s Perspective](https://www.bcm-institute.org/about-us/a-presidents-perspective/)
- [Our History](https://www.bcm-institute.org/about-us/our-history/)
- [Our Advisory Council](https://www.bcm-institute.org/about-us/our-advisory-council/)
- [Customers’ Testimonials](https://www.bcm-institute.org/about-us/customers-testimonials/)
- [Credential Verification](https://www.bcm-institute.org/about-us/credential-verification/)
- [Courses](https://blog.bcm-institute.org/blog/course-fees-for-blended-learning-courses-master-catalog)
- [ISO 22301 Business Continuity Management System Audit](https://blog.bcm-institute.org/audit/business-continuity-management-audit-courses)
- [ISO 22301 Business Continuity Management](https://blog.bcm-institute.org/bcm/business-continuity-management-courses)
- [Crisis Communication](https://blog.bcm-institute.org/crisis-communication/crisis-communication-courses)
- [Crisis Management](https://blog.bcm-institute.org/en/crisis-management/courses)
- [IT Disaster Recovery](https://blog.bcm-institute.org/it-disaster-recovery/courses)
- [Operational Resilience](https://blog.bcm-institute.org/operational-resilience/courses)
- [Operational Resilience Audit](https://blog.bcm-institute.org/operational-resilience-audit/courses)
- [Certification](https://blog.bcm-institute.org/certification/types-of-certifications-offered)
- [ISO 22301 BCMS Audit Certification](https://blog.bcm-institute.org/certification/business-continuity-management-audit-certification)
- [ISO22301 Business Continuity Management Certification](https://blog.bcm-institute.org/bcm/business-continuity-management-certification)
- [Crisis Communication Certification](https://blog.bcm-institute.org/crisis-communication/crisis-communication-certification)
- [Crisis Management Certification](https://blog.bcm-institute.org/en/crisis-management/crisis-management-certification)
- [IT Disaster Recovery Planning Certification](https://blog.bcm-institute.org/it-disaster-recovery/it-disaster-recovery-certification)
- [Operational Resilience Certification](https://blog.bcm-institute.org/operational-resilience/operational-resilience-certification)
- [Operational Resilience Audit Certification](https://blog.bcm-institute.org/operational-resilience-audit)
- [Seminars](https://blog.bcm-institute.org/meet-the-expert/mte-webinar-mainpage)
- [Store](https://www.bcm-institute.org/store-2/)
- [Contact Us](http://www.bcm-institute.org/about-us/contact-us/)
-
-
###### Building a Resilient Banking Institution: Operational Resilience Implementation at China Construction Bank (Malaysia)
# \[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/94e06422-4ab9-4bfe-94bd-545de5200261)
Under the operational resilience framework, China Construction Bank (Malaysia) Berhad (CCB Malaysia) must identify Severe but Plausible (SBP) Scenarios that could disrupt its Critical Business Services (CBS).
As highlighted in the referenced guidance, SBP scenarios are events that are extreme in impact yet realistic in likelihood, based on the institution’s risk profile, operating environment, and threat landscape.
For CBS-1: Core Deposit & Account Services, disruption could severely affect customers’ access to funds, payment obligations, regulatory compliance, and financial stability.
Therefore, scenario design must integrate cyber risks, ICT failures, third-party dependencies, operational errors, and external threats, ensuring alignment with the bank’s overall technology and cyber risk management framework.
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
[Moh Heng Goh](https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh) Mar 12, 2026
###### Operational Resilience Certified Planner-Specialist-Expert
### [![\[OR\] \[CCB\] Legal Disclaimer Banner](https://no-cache.hubspot.com/cta/default/3893111/6b0c36e9-6fb9-4705-a42a-089010976426.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/6b0c36e9-6fb9-4705-a42a-089010976426)
### [](https://cta-redirect.hubspot.com/cta/redirect/3893111/c9c3fddf-009e-4d50-b91c-b18d1228e9ef)
### CBS-1 Core Deposit & Account Services
#### Introduction
[![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/b42bebcb-9b67-4235-a6be-d107512cf0de.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b42bebcb-9b67-4235-a6be-d107512cf0de)
Under the operational resilience framework, China Construction Bank (Malaysia) Berhad (CCB Malaysia) must identify **Severe but Plausible Scenarios** **(SbPS)** that could disrupt its Critical Business Services (CBS).
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/b82f4b68-92a3-4741-a22a-c2df4a0479f2)As highlighted in the referenced guidance, SBP scenarios are events that are extreme in impact yet realistic in likelihood, based on the institution’s risk profile, operating environment, and threat landscape.
For **CBS-1: Core Deposit & Account Services**, disruption could severely affect customers’ access to funds, payment obligations, regulatory compliance, and financial stability.
Therefore, scenario design must integrate **cyber risks, ICT failures, third-party dependencies, operational errors, and external threats**, ensuring alignment with the bank’s overall technology and cyber risk management framework.
The table below outlines the recommended SBP scenarios for each Sub-CBS, including impact assessments, proactive mitigation measures, and explicit linkages to Cyber and ICT risk integration.
[![Banner \[Table\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f4f3c007-e864-48cd-8bc1-0242c8b7fd86)
###### Table P5: Detailed Processes for CBS-1
| Sub-CBS Code | Sub-CBS | Severe but Plausible Scenario | Impact / Effect | Proactive Risk Management Action | Link to Integration of Cyber and ICT Risks |
| --- | --- | --- | --- | --- | --- |
| 1.1 | Account Opening & Onboarding | Prolonged outage of the digital onboarding platform due to a ransomware attack on customer onboarding servers | Inability to open new accounts; onboarding backlog; KYC delays; reputational damage | Implement endpoint detection & response (EDR); segregate onboarding servers; maintain offline KYC processing capability; conduct cyber recovery drills | Integration with Cyber Security Framework (NIST/ISO 27001), secure SDLC, identity & access management (IAM), ransomware resilience testing |
| 1.2 | Deposit Maintenance & Account Administration | Core banking system configuration corruption following failed system patch update | Inaccurate customer data; inability to update account details; regulatory reporting inaccuracies | Change management controls; pre-production testing; system rollback capability; automated data reconciliation | ICT change management governance; patch management controls; configuration monitoring tools |
| 1.3 | Deposit Transactions Processing | Data centre outage due to a power failure, combined with DR replication lag | Customers unable to access funds; ATM/online transaction failures; liquidity stress | Active-active data replication; periodic DR failover testing; UPS & generator redundancy; real-time monitoring | Data centre resilience strategy; Recovery Time Objective (RTO)/Recovery Point Objective (RPO) alignment; infrastructure redundancy |
| 1.4 | Interest & Charges Calculation & Posting | Batch processing engine failure at month-end caused by database overload or cyber intrusion | Incorrect interest postings; financial misstatements; customer disputes | Capacity stress testing; automated reconciliation controls; database activity monitoring; segregation of duties | Database security controls, ICT capacity planning, privileged access management |
| 1.5 | Account Inquiry & Statement Services | A Distributed Denial of Service (DDoS) attack on an internet banking platform | Customers unable to view balances; surge in call centre traffic; reputational impact | DDoS mitigation services; traffic filtering; multi-channel access (branch, RM support); communication protocol | Network security architecture; SOC monitoring; cyber threat intelligence integration |
| 1.6 | Transfer & Payment Execution | Malware infection affecting the payment gateway interface with RENTAS/FPX/SWIFT | Payment delays or failures; settlement breach; regulatory penalties; systemic risk implications | Network segmentation; real-time transaction monitoring; payment contingency procedures; secure SWIFT controls (CSP compliance) | SWIFT Customer Security Programme (CSP); payment system cybersecurity controls; transaction anomaly detection systems |
| 1.7 | Foreign Currency Deposit Services | Disruption of the external FX rate feed provider due to a third-party cyber incident | Incorrect FX conversion rates; financial losses; customer disputes | Third-party risk assessments; secondary FX data provider; automated rate validation controls | Third-party ICT risk management; API security controls; vendor resilience testing |
| 1.8 | Account Closure & Dormancy Management | Failure of the AML monitoring system due to a software defect or a cyber compromise | Inadequate dormancy controls; AML/CFT compliance breach; regulatory sanctions | Periodic AML system validation; manual oversight review; backup compliance monitoring process | AML system cybersecurity controls; data integrity checks; compliance system redundancy |
##### **Key Risk Themes Identified**
Across CBS-1, the most material Severe but Plausible Scenarios involve:
- **Cyber threats** (ransomware, DDoS, malware, data corruption)
- **ICT infrastructure failures** (data centre outages, system overloads)
- **Third-party service disruptions** (FX data providers, payment gateways)
- **Change management weaknesses**
- **Data integrity and reconciliation risks**
Integration with Cyber and ICT risk frameworks ensures that resilience measures are not siloed but embedded within enterprise-wide security governance, including Security Operations Centre (SOC) monitoring, threat intelligence, privileged access management, and disaster recovery strategies.
[![Banner \[Summing\] \[OR\] \[E3\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/446ccb83-e056-40d0-aae5-834d73c13f43.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/446ccb83-e056-40d0-aae5-834d73c13f43)
Identifying Severe but Plausible Scenarios for **CBS-1: Core Deposit & Account Services** enables China Construction Bank (Malaysia) to rigorously test its resilience posture against high-impact, realistic disruption events.
These scenarios ensure that the bank moves beyond theoretical risk assessment to practical stress-testing of operational capabilities.
By integrating cyber security, ICT resilience, third-party risk management, and governance controls into scenario planning, CCB Malaysia strengthens its ability to anticipate, withstand, and recover from operational shocks.
This structured identification of SBP scenarios supports regulatory compliance, safeguards customer interests, and reinforces confidence in the bank’s core deposit and payment services—ensuring sustainable operational resilience in an increasingly digital and interconnected banking environment.
| Building a Resilient Banking Institution: Operational Resilience Implementation at China Construction Bank (Malaysia) | | | | | | | | | | |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| **eBook 3: Starting Your OR Implementation** | | | | | | | | | | |
| **CBS-1 Core Deposit & Account Services** | | | | | | | | | | |
| **CBS-1 DP** | **CBS-1 MD** | **CBS-1 MPR** | **CBS-1 ITo** | **CBS-1 SuPS** | ** CBS-1 ST ** | **eBook 2** | | | | |
| [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[DP\] Core Deposit & Account Services](https://no-cache.hubspot.com/cta/default/3893111/70b3123a-bbfb-4846-abc4-03afd7ed6295.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/70b3123a-bbfb-4846-abc4-03afd7ed6295) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[MD\] Map Dependency](https://no-cache.hubspot.com/cta/default/3893111/7783bc34-2caf-41dd-8a79-f49495b3fa7c.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7783bc34-2caf-41dd-8a79-f49495b3fa7c) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[MPR\] Map Processes and Resources](https://no-cache.hubspot.com/cta/default/3893111/33402972-1850-4473-8b4e-941bff695fb6.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/33402972-1850-4473-8b4e-941bff695fb6) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[ITo\] Establish Impact Tolerances](https://no-cache.hubspot.com/cta/default/3893111/031102ef-eb14-442d-822e-f4779c89cd15.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/031102ef-eb14-442d-822e-f4779c89cd15) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[SuPS\] Identify Severe but Plausible Scenarios](https://no-cache.hubspot.com/cta/default/3893111/b42bebcb-9b67-4235-a6be-d107512cf0de.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/b42bebcb-9b67-4235-a6be-d107512cf0de) | [![\[OR\] \[CCB\] \[E3\] \[CBS\] \[1\] \[ST\] Perform Scenario Testing](https://no-cache.hubspot.com/cta/default/3893111/7ce11b80-4ff1-48c5-8b98-d245d2b2558f.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/7ce11b80-4ff1-48c5-8b98-d245d2b2558f) | [![eBook Cover \[OR\] \[CCB\] \[E2\] \[2D\]](https://no-cache.hubspot.com/cta/default/3893111/9b21eac0-621d-41c1-a95b-81665c719a89.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/9b21eac0-621d-41c1-a95b-81665c719a89) | | | | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/0fd66f64-f7a8-4c65-a54b-9c56982c138c) |
[](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6)[](https://cta-redirect.hubspot.com/cta/redirect/3893111/13a448f1-f09c-42da-a57e-0988e41658c5)Gain Competency: For organisations looking to accelerate their journey, BCM Institute’s training and certification programs, including the OR-5000 Operational Resilience Expert Implementer course, provide in-depth insights and practical toolkits for effectively embedding this model.
#### More Information About OR-5000 \[OR-5\] or OR-300 \[OR-3\]
To learn more about the course and schedule, click the buttons below for the OR-300 Operational Resilience Implementer course and the OR-5000 Operational Resilience Expert Implementer course.
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/3530eccb-515d-401e-afc2-3469e26d7fbf) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/fdd4fa9c-ed69-40c1-925f-4eb6a1c5c255) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/77a34b84-0a6d-44f8-b8d6-6ab04cdf5edd) |
| --- | --- | --- |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/6e5c0cda-39b9-4bbd-b3d4-4cf46a790b14) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/a68a08aa-36d3-4216-9551-202c9fde06ea) | [![ \[BL-OR\] \[3-4-5\] View Schedule](https://no-cache.hubspot.com/cta/default/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/d0d733a1-16c0-4b68-a26d-adbfd4fc6069) |
| [![\[BL-OR\] \[3\] FAQ OR-300](https://no-cache.hubspot.com/cta/default/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/f20c71b4-f5e8-4aa5-8056-c374ca33a091) | If you have any questions, click to contact us.[![Email to Sales Team \[BCM Institute\]](https://no-cache.hubspot.com/cta/default/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e.png)](https://cta-redirect.hubspot.com/cta/redirect/3893111/3c53daeb-2836-4843-b0e0-645baee2ab9e) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/7f2718a4-ea80-4f84-a319-dc2d4df37a46) |
| [](https://cta-redirect.hubspot.com/cta/redirect/3893111/74b1e556-8cd2-4a74-8821-db1804534955) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/f2bd8eb1-32d2-4732-9267-ea53223cf58f) | [](https://cta-redirect.hubspot.com/cta/redirect/3893111/084e620a-46c5-419a-82ed-6a681d15c0b6) |
#### **Comments:**
---
---
---
---
All rights reserved. Copyright 2026
```json
{
"@context" : "https://schema.org",
"@type" : "BlogPosting",
"author" : {
"@type" : "Person",
"name" : "Moh Heng Goh",
"url" : "https://blog.bcm-institute.org/ebook-or/author/moh-heng-goh"
},
"dateModified" : "2026-03-13T14:01:18.955Z",
"datePublished" : "2026-03-12T03:07:46.000Z",
"headline" : "[OR] [CCB] [E3] [CBS] [1] [SuPS] Identify Severe but Plausible Scenarios",
"mainEntityOfPage" : {
"@id" : "https://blog.bcm-institute.org/ebook-or/or-ccb-e3-cbs-1-sups-identify-severe-but-plausible-scenarios",
"@type" : "WebPage"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://blog.bcm-institute.org/hubfs/BCMI%20Logo.png"
},
"name" : "BCMI Pte Ltd"
}
}
```